BLINDINGCAN

Malware & Tools · BLINDINGCAN

· MalwareS0520 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

BLINDINGCAN is a remote access Trojan that has been used by the North Korean government since at least early 2020 in cyber operations against defense, engineering, and government organizations in Western Europe and the US.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: NHS UK BLINDINGCAN Aug 2020)

Tactic Coverage

stealth (7)discovery (4)command and control (4)execution (3)collection (1)exfiltration (1)defense impairment (1)initial access (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (22)

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1027.002Software Packing

stealth

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1059.003Windows Command Shell

References

https://attack.mitre.org/software/S0520 https://digital.nhs.uk/cyber-alerts/2020/cc-3603 https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a